2,385 reputation
11019
bio website
location
age
visits member for 2 years, 11 months
seen 4 hours ago

Sep
3
comment Is the Web browser status bar always trustable?
Where is Chrome "status bar"?
Sep
3
comment Is the Web browser status bar always trustable?
@RBerteig Yes: some people copy and post the Google feedback URL to forums instead of the destination URL. Google should use PING (and browser should enable PING whenever they allow this destination hiding).
Sep
3
comment Is there any reason to show the same message for invalid username as password?
Rate Limit globally? by origin IP?
Sep
3
suggested suggested edit on Do salts have to be random, or just unique and unknown?
Sep
2
comment Do salts have to be random, or just unique and unknown?
let us continue this discussion in chat
Sep
1
comment Do salts have to be random, or just unique and unknown?
@MisterMelancholy "unknown" "entropy" I think you need to check the definition of "entropy". It does not mean "I don't know the answer", it is bound on the probability of correctly guessing the answer with x tries. Practically, a lot of entropy means you cannot guess the correct answer, ever, even if you try as much as you can in a lifetime.
Aug
28
comment How can I implement DVD copy protection?
@FakeRainBrigand This is a general principle. For any standard protection method that is not so good, since there is market and it is doable, there will be a tool, it will be available on the Internet, and people with zero CS knowledge will be able to use it.
Aug
27
comment Please help verify my understanding of Domain Validation (DV) SSL Certificate
What about a browser who has just seen an EV certificate, who sees another cert?
Aug
27
comment Please help verify my understanding of Domain Validation (DV) SSL Certificate
"An EV certificate will protect you against sloppy CA only as long as your clients are trained to pause and become suspicious if they see a seemingly valid but non-EV certificate bearing your site name." and by client, you mean client software, right?
Aug
27
comment What does capture filter means in wireshark?
Libpcap filter syntax may not be user friendly, but on a busy interface, you probably need to learn it if you don't want to deal with huge capture files.
Aug
26
comment Password management in Firefox, Chrome and Safari
Are you assume a "one strike" attack (you get once the control of the logged-in computer)? Can you come back? Can you install software?
Aug
26
comment Password management in Firefox, Chrome and Safari
I knew I was going to see this question about the outrage about nothing.
Aug
19
comment Can malware come in any format?
You can rename a PDF file with a .txt extension and try to open it in a text editor, but I doubt it will do much good.
Aug
8
comment Secure Session Cookies
I think you are confusing "Non-repudiation" and integrity.
Aug
8
comment Secure Session Cookies
@symcbean "Browsers vary in whether they manage cookies in a central store" which browsers do not behave as if they used a central cookie store? (Using "private mode" and multiple "profiles" do not count, any functionality intended to change your online identity and session state do not count.)
Aug
8
comment Is a cookie safer than a simple HTTP header?
@Joshua "If an attacker injects an image, javascript" If the attacker can inject JS, then he just controls the webpage. He does not need the capture a Referer. He can read (even capturing form data) and modify any part of the page (displaying incorrect information to the user, or changing form data just before submission), and retrieve any cookie not marked HTTPOnly, and do anything on behalf of the user.
Aug
8
comment Is a cookie safer than a simple HTTP header?
"Safe" is a meaningless term, just as "secure". You have to define a context: who is your adversary? Do you consider the possibility of wiretapping? Do you consider a website with user supplied contain, like this very website?
Aug
8
comment Is a cookie safer than a simple HTTP header?
@lynks The Referer contains the whole URL as sent to the HTTP server. It does not contain the local part after the #.
Aug
8
comment Is a cookie safer than a simple HTTP header?
1: You (the webmaster) control the outbound links. If you can manage to have only links to sites under your control, 1. is not a problem. 2: Who implements Cookie2?
Aug
8
comment wpa2-psk + wireless isolation = secure connection?
It there a standard definition of "isolation"?